Guys i have a doubt and i want to get your opinions on it. I use keycloak for idp and my application needs role based access control. Keycloak provides RBAC but AI tells me it is better to create your own RBAC in the application with its own database and leave keycloak just for authentication. Is it right? should i avoid using keycloak of authorization ?
Instead of example.com/realms/app-realm, i want it just example.com/
Or if anyone else has another identity provider solution where url and login page's css is customizable, that would be perfect.
Hey everyone. I'm doing my Computer Science final year project and wanted some opinions from people outside my own head before I go much further.
The problem: Keycloak is a really popular open source tool that handles logins and permissions for a lot of companies. It's great at checking who you are and whether you have a specific permission. But once access is granted, nothing ever checks whether it still makes sense. People change roles, permissions pile up, accounts sit unused for months, and none of that gets reviewed.
I looked into whether this gap already had a solution before committing to it. Some tools cover parts of it. midPoint is open source and does combine rules with some anomaly detection, but it's a whole separate platform you have to adopt, not something you add on top of an existing Keycloak setup. Commercial tools like SailPoint and Saviynt have anomaly detection too but it's a black box, you can't see how it actually works, and they're priced for large enterprises. So the specific gap I'm going after is a lightweight governance layer you can add onto an existing Keycloak deployment without replacing anything.
My solution has two parts working together. A rule engine that catches known dangerous permission combos, like someone who can both create and approve the same payment. And an anomaly detector using Isolation Forest that flags access patterns that look statistically unusual compared to a user's peers, even when there's no specific rule written for it. Both feed into a dashboard where an admin can see who got flagged and exactly why, and decide what to do about it.
Some features so far:
Admin editable rules, not hardcoded
Isolation Forest running on engineered features like permission count, deviation from peers, and days since last login
Dormant account detection based on login history
A dashboard showing a combined risk score where you can actually see why someone was flagged, not a hidden formula
Nothing gets auto revoked, it's meant to prompt a human to review
Would love to hear if this sounds like a solid direction or if I'm missing something obvious. Also curious if anyone here has actually dealt with identity governance tools at work and can tell me whether this is genuinely useful or if I'm solving a problem nobody really has.
Guys i was working with keycloak and it default styling on login pages were very old schoolish. So i used keycloakify to theme it using shadcn components. Also theming the email was pain, i don't want people to go through the same. So i am open sourcing the setup which has all the pages and email themed to match shadcn-svelte design system. Check it out, contribute, and i hope it is helpful
We built a passkey solution for our customers for passwordless login. It works great but we are seeing 3-5 % of errors during passkey login. Most of these errors are null pointer errors from the webauthn authenticator. It was expecting essential client data which is coming as blank. For Example attestation, challenge etc. I can’t figure out why certain form submissions will miss client data! Webauthnauthenticate.js sets an error if there is an error in the webauthn ceremony but I don’t see that either